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The accredited security level of this system is: TOP SECRET//SI-GAMMA/TALENT KEYHOLE//ORCON/PROPIN 

/RELIDO/REL TO USA, FVEY * 

TOP SECRET//SI//REL TO USA, FVEY 



(U) LONGHAUL 

From Wikiinfo 

(TS//SI/REL) The LONGHAUL system provides the Extended NSA Enterprise with an 
end-to-end attack orchestration and key recovery service for Data Network Cipher (DNC) and 
Data Network Session Cipher (DNSC) traffic. LONGHAUL is extensible to allow for the addition of 
other Digital Network Intelligence cipher types. 
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(U//FOUO) LONGHAUL Overview 

(U) General 

(U) DataFlow and CONOP 

(TS//SI//REL) The LONGHAUL system is composed of several components as shown in this 
End-to-End View. LONGHAUL receives cryptanalytic information (CA Data) from the field systems 
and passes information back to field systems using its Front End. The Front End validates the 
sender/receiver using CASPORT services. LONGHAUL contains Attack Orchestration 
components (one orchestrator for each distinct type of attack), and Attack Service components. 
Attack orchestration figures out what cryptanalytic processing should be applied for each piece of 
CA Data, and then initiates, and as needed manages, that processing. Attack service performs the 
cryptanalytic attack. Once the processing is complete, the result is returned to the attack 
orchestration component, information about the processing is "saved" for Management and 
Analysis, and then as appropriate the result is returned to the "requesting" CA Server. 
LONGHAUL accesses CES Databases for certain information needed for attack orchestration and 
attack services. LONGHAUL also provides an interface for CES Analysts that need access to 
information pertaining to the LONGHAUL processed data. LONGHAUL maintains its own internal 
databases for the management and control of its processing activities. 




(TS//SI//REL) LONGHAUL (in Purge Surge parlance) is a Collection Store, that is a "system that 
processes and/or retains collected SIGINT data items, and that permits access to those 
performing collection functions and limits access of those performing intelligence analysis". 
LONGHAUL maintains internal databases that contain Cryptanalytic "technical data", and 
LONGHAUL also exchanges Cryptanalytic "technical data" with other CES databases and with 
CES HPC resources that perform cryptanalytic attacks. This "technical data" includes recovered 
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keys, information about what crypt processing is appropriate, data needed for cryptanalytic 
attacks, as well as information retained to enable future cryptanalytic attacks. LONGHAUL does 
not store cipher data or ever have access to decrypted data. If the "technical data" passed to 
Attack Service components or CES databases contains information from the collected stream (as 
opposed to information about the collected stream such as SIGAD, DTOI), then appropriate 
Critical Identifying Information (CII) will be passed also. From a compliance perspective this is 
the system being "certified". 

(TS//SI//REL) Field deployed collection systems and CA Servers (also known as Extended 
LONGHAUL) are shown on the left. A CA Server is the field CES component that runs CA 
Services. The terms CA Server or CA Services are used depending on the context 
(hardware/so ftware). For information on CA Server deplo yments see the CES/DNCA wiki pages 
CA Servers , and for information on CA Server 

architecture see LONGHAUL/CA Server. The CA Server stores cipher data, and decrypts it based 
upon a key returned by LONGHAUL. 

(S//SI//REL) LONGHAUL is a High Availability system using hardware at two geographically 
distributed locations to also provide a COOP capability. LONGHAUL uses the Application 
Messaging Framework AMF with the ISLANDTRANSPORT (ITx) transport and 
ISLANDHIDEAWAY (IH) integrity and privacy capabilities to send data between collection 
systems and LONGHAUL. The requestor of CA Services (the field deployed CA Server) never 
knows (or needs to know) which hardware is used to process its requests. LONGHAUL and the 
AMF manage the physical routing and failover behavior of the system. 

(TS//SI//REL) LONGHAUL has a Service-Oriented, Java-Based Enterprise Architecture. It includes 
multiple coordinated software development efforts. Each Attack Orchestrator is a major 
development effort, as are the Management and Analysis and Security and Policy 
components. LONGHAUL also has a hardware acquisition component, and manages the 
interfaces and integration activities with TURMOIL/TURBULENCE (collection), and the High 
Performance Computing (HPC) activities of CES/T5. The LONGHAUL team is responsible for all 
phases of development, starting with requirements, thorough design, technology selection, 
development, integration, system test, and deployment. The team is also responsible for the 
system engineering and hardware design and acquisition to support a two-site, high-availability 
system. 

(C//SI//REL) In July 2010, Tl, T5 and CES signed an SLA > for "the provisioning and support of 
Cryptanalytic (CA) Services within the TURBULENCE Passive Collection Suite (TU PCS)." 

(U//FOUO) Attack Orchestration 

(U//FOUO) POISONNUT 

(TS//SI//REL) POISONNUT is a Child LONGHAUL 

Project that enables Data Network Cipher (DNC) Recovery. Initial Customer Capability was 
released on September 30, 2009. LONGHAUL/POISONNUT (DNC) was determined by CES and 
T5 SPO to be IOC on 10 Jan. 2011. 

(U//FOUO) SCARLETFEVER 

(TS//SI//REL) SCARLETFEVER is a Child 

LONGHAUL Project that enables Data Network Session Cipher (DNSC) Recovery. Initial 
Customer Capability was achieved in December 2010. 

(U) Management and Analysis 

(U) For this very high level view our diagram shows Management and Analysis as one block. 
This block contains many components and further details can be found on the Software 
Architecture page. 

(U) Additionally, LONGHAUL has begun to create a set of web applications for Management 
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(Operations and Mission) and Mission Analysis which can be found here: Web Applications List 




(U) Security and Policy 



(U//FOUO) SPAM is our Security Policy and Adjudication Module which will be used to apply 
rules for sanitizing, filtering, and determining if a response should be sent to a particular client. 

(U) Common 

(S//SI//REL) All child projects share LONGHAUL COMMON components or services. This is not 
shown as a separate block on the diagram as all the components use COMMON. 

(U) Interfaces (ICD) 

(U) All Interfaces are described on the ICD wiki page. These include both the external interfaces 
(how a CA Server communicates with LONGHAUL) as well as the interfaces LONGHAUL uses 
with other CES systems. 

(U) Design 

(U) Architecture 

(U//FOUO) Software and Hardware architecture discussions are available on the LONGHAUL 
Architecture page. 

(U) High Availability 

(S//SI//REL) LONGHAUL is a high availability system that makes use of Continuity of Operations 
(COOP) to meet availability requirements. The system is designed from both hardware and 
software perspectives to provide high availability ensuring that key recovery services are always 
available. The two site deployment with equal processing capacity will meet the COOP 
requirement for the system. Each system is designed with redundant hardware and processes so 
that the system can survive any single component (hardware or software) failure. During normal 
operation, both systems will be operational and share the processing load. In the event of a single 
site failure, the second site will, within seconds, assume total processing responsibility, but at 
reduced capacity. The requestor of CA Services (the field deployed CA Server) never knows (or 
needs to know) which hardware is used to process its requests. CA Servers send data to 
LONGHAUL and receive responses from LONGHAUL using the AMF. LONGHAUL and the AMF 
manage the physical routing and failover behavior of the system. 

(U//FOUO) For more detailed information, see Availability Analysis. 

(U) AMF/ITx JMS Messaging 

(U//FOUO) The use of a high capacity, low latency JMS messaging fabric is critical to the success 
of the LONGHAUL mission. LONGHAUL has worked closely with the Application Messaging 
Framework (AMF) team to design a fabric to support the LONGHAUL requirements. 

(U) See AMF / LONGHAUL Teaming for more detailed information. 

(U//FOUO) The collection site clients (CA Servers) will publish messages into the fabric with no 
knowledge of where the processing actually occurs. The fabric should support both active/active 
and active/passive processing modes. In active/active mode multiple sites would consume the 
same message, and manage the client response strategy. In active/passive, one site would 
consume a message, but in a failure mode, an alternate site would seamlessly pick up message 
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consumption. 

(U) Deployment 

(U) Hardware 

(U//FOUO) LONGHAUL is composed of almost identical hardware at two geographically 
distributed sites - the Tordella Supercomputer Building (TSCB) at Fort Meade and Oak Ridge 
Data Center (ORDC) in Oak Ridge, Tennessee. The initial hardware configurations for TSCB and 
ORDC arrived in November 2009 and May 2010 respectively. The final configurations arrived in 
Jan 2011 at both sites. A system, termed "Hadoop Cluster" has also been purchased to produce 
analytics and store metrics for LONGHAUL. The Hadoop Cluster will reside at ORDC and is 
scheduled to be delivered in April 2011. CAVIUM is being considered for CA Server. 

(U) For more detailed information, see Hardware Description and Schedule. 

(U) Software Releases 

(U//FOUO) LONGHAUL 3.4.0 was released on February 27, 2013. The release consists of: 

■ (U//FOUO) LONGHAUL Common_3.4.1 - Full Release. Built on 12 February 2013. 

■ (U//FOUO) Added Capabilities 

■ (TS//SI//REL) HEROICSAND improvements and initial metrics 

■ (U//FOUO) Bug fixes and minor enhancements 



■ (U//FOUO) Included tracker artifacts v3.4.1 (| 




■ (U//FOUO) Included tracker artifacts v3.4.0 ( 




■ (U//FOUO) POISONNUT 3.4.1 - Full Release. Built on 12 February 2013. 
■ (U//FOUO) Added Capabilities 



■ (U//FOUO) Bug fixes and minor enhancements 
■ (U//FOUO) Included tracker artifacts v3.4.1 (HjjjjH 




■ (U//FOUO) Included tracker artifacts v3.4.0 




■ (U//FOUO) SCARLETFEVER 3.4.1 - Full Release. Built on 12 February 2013. 

■ (U//FOUO) Added Capabilities 

■ (TS//SI//REL) Fix PLATINUMRING timeouts for GALLANTWAVE 

■ (TS//SI//REL) Increased capacity 

■ (U//FOUO) Bug fixes and minor enhancements 

■ (U//FOUO) Included tracker artifacts v3.4.1 



■ (U//FOUO) Included tracker artifacts v3.4.0 



■ (U//FOUO) WOLVERINESTAKE 3.4.1 - Full Release. Built on 12 February 2013 

■ (U//FOUO) Added Capabilities 

■ (U//FOUO) Bug fixes and minor enhanc ements 

■ (U//FOUO) Included tracker artifacts v3.4.1 



■ (U//FOUO) Included tracker artifacts v3.4.0 ( 
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■ (U//FOUO) NINJACOVE 3.4.1 - Full Release. Built on 12 February 2013. 
■ (U//FOUO) Added Capabilities 

■ (U//FOUO) Bug fixes and minor enhancements 




■ (U//FOUO) JEDIMINDTRICK3.4.1 - Full Release. Built on 12 February 2013. 
■ (U//FOUO) Added Capabilities 



■ (U//FOUO) Bug fixes and minor enhanc ements 
■ (U//FOUOMnchxdecHrackei^rtifact^3A(M^^^H 





(U//FOUO) For more detailed information, see LONGHAUL Releases. 

(U) Development 

(U) Software/Schedules 

(U) Four major releases are planned - 2009, 2010, 2011, 2012 - with minor releases in between as 
needed. 



(U//FOUO) Release 1.0 - September 30, 2009 - Initial Customer Capability 

(U//FOUO) Release 2.1 - December 30, 2010 - Initial Operational Capability 

(U//FOUO) Release 2.2.0 - July 7, 2011 - DNSC Scaling 

(U//FOUO) Release 2.3.0 - October 26, 2011 - Initial COOP Capability 

(U//FOUO) Release 2.4.0 - January 11, 2012 - COOP and Scaling Capability 

(U//FOUO) Release 2.5.0 - Febuary 29, 2012 - CHAOTICSTORMTROOPER and JEDIMINDTRICK 
Webapps 

(U//FOUO) Release 2.6.x - Mar. 31, 2012 - Availability Improvements and Cross Agency Pairing 
Prototype 

(U//FOUO) Release 2.7.x - Apr. 30, 2012 - Availability and DNSC Performance Improvements 

(U//FOUO) Release 2.8.x - May. 31, 2012 - FOC Release 

(U//FOUO) Release 2.9.x - June 30, 2012 - TBD 

(U//FOUO) Release 3.0.x - July 31, 2012 - TBD 

(U//FOUO) Release 3.1.x - Aug. 31, 2012 - TBD 
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(U//FOUO) Release 3.2.x - Sept. 30, 2012 - TBD 
Plannedcapabilitvdetails can be found here 

(TS//SI//REL) Each LONGHAUL child project had its own schedule. Projects used to be planned 
quarterly "Phases" with monthly "Milestones". 

(U) Development Principles, Processes, and Standards 



(U//FOUO) LONGHAUL strives to use best practices in all its development 
activities, and is continually looking for ways to improve. We continue to 
refine our processes and want to share with and learn from other projects 
as well as the NSA Way. Please explore our wiki and "take" what you need. 
Conversely, if you have something that works for you, please contact us. 
POISONNUT was the first LONGHAUL child project, and the processes 
were initially developed then, but now all the child projects are using them 
LONGHAUL Principles is a description of our development principles, and 
Aug 2010 Overview > is a summary brief of the project, process and tools 
we are using. 




(U//FOUO) 

LONGHAUL 

Principles 



(U//FOUO) LONGHAUL Processes 

(U//FOUO) Detailed information for each LONGHAUL process is available below. 

(U) Requirements 

(U//FOUO) Requirements Development we use DOORS for maintaining all 

our requirements. 

(U) Coding Standards/Reviews 

(U//FOUO) Coding Standards - Project Coding Standards 

(U//FOUO) Code Reviews ^^^^^^^^^^LONGHAUL Code Review Process and Code 
Review Checklist 

(U) Lessons Learned 

(U//FOUO) Lessons Learned Changes made as a result of development 

experience 

(U) Configuration Management (and Metrics) 

(U//FOUO) Configuration Management Configuration Management, Change 

Management and Metrics 

(U) Testing 

(U//FOUO) Test Methodologies Testing Description 

(U//FOUO) Unit Testing Unit Test Guidelines Q 

(U//FOUO) Integration Testing - Testing with ISLANDTRANSPORT 

(U//FOUO) System Testing - System Test plans and schedules. 
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(U) Working with NS A Way 

(^//SI/REL^h^LONGHAUL Project is an enthusiastic participant in the NSA Way 

. Because the LONG HAUL team is responsible for all phases of 
development starting with requirements, through design, technology selection, development, 
integration, system test, and deployment, it uses a modified NSA Way Gate structure. 

(U) Development and Management Tools 



LONGHAUL relies on a variety of tools to support development and management tasks. The tools 
listed below have been assessed and found to be valuable 



(U//FOUO) Project Management i 
including a bug and feature tracker i 



I) (restricted) 

(U//FOUO) Subversion Repository - available for browsing 

(restricted) 

(U//FOUO) Maven Repository - an instance of Sonatype Nexus 



(U//FOUO) Continuous Builds - an instance of Hudson (I 



(U//FOUO) CORALREEF - a test instance is running specifi cally for us on scubadiver2 

or coralreef-ua 
I) • 




(U) Technology 



■ (U) Integrating Java with C/C++ 

■ (U) JMS Performance Testing 

■ (U) OMQ Messaging 

■ (U) Terracotta Performance Testing 

■ (U) HBase Performance Testing 

■ (U) Scala Research 




(U) In-Memory Distributed Data Analysis of Alternatives 
(AOA) 



■ (U) The project is looking into several technologies for in-memory data caches with 
replication. 

■ (U) For more information, view the Distributed Data AOA 

(U) BigData and Metrics Techniques 

■ (TS) LONGHAUL MapReduce •' 

■ (TS) Hadoop Metrics Implementation 



(U) TE6 Security, Compliance and Policy 
Enforcement 



■ (C//REL) LONGHAUL's position in the processing chain necessitates that it be prepared to 
deal with a whole host of security, policy and compliance enforcement issues, such as 
ensuring that the system is only accessed by authorized individuals, ensuring that the 
processing meets all legal requirements, resolving classifications from multiple sources. 
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ensuring that the recovered cryptovariables are only distributed to those entities that are 
authorized to receive them, ensuring that clients don't exceed some policy-defined limit on 
amount of work requested, and a whole host of other issues. This page seeks to capture the 
important security, compliance, and policy related scenarios LONGHAUL will address and 
document the design of their solutions. 

■ (U//FOUO) For details, see LONGHAUL Security, Compliance and Policy 

(U) TS Certification & Accreditation 

■ (U//FOUO) This link contains information pertaining to LONGHAUL SSPs (System Security 
Plans)- LONGHAUL Certification & Accreditation 

■ LONGHAUL IAVA Patch Rollout Scheme 

(U) Operations 

(U//FOUO) LONGHAUL has been processing DNC data since Oct. 2009, and was declared IOC for 
DNC in Dec. 2010. Also, in Dec. 2010 an ICC (Initial Customer Capability) for DNSC was 
deployed. 24/7 System monitoring has been in place since Dec. 2010. 

■ (U//FOUO) Operations Manager 

- responsible for the operations of LONGHAUL. 

■ (U//FOUO) IMPORTANT: Use t he gDocUpdate Website 

for the proper UNCLASSIFIED terms when talking over the 

black line. 

■ (U) LONGHAUL/ Contact - For general contact information. 

■ Process - the steps 

need to be taken to ensure continued security when a person leaves the project. 

(U) Tier 1 Support 

(U) GECC - provides Tier 1 First Response/Help Desk support. The GECC attempt to resolve 
unexpected operational issues using well-defined procedures. If resolved by the GECC, then the 
details of the resolution are recorded and no further action is required. If the incident cannot be 
resolved using the remote capabilities at the Operations Center's disposal or within the 
pre-determined time threshold, the incident is escalated to Tier 2 for resolution. 

■ (U//FOUO) LONGHAUL Special Instructions - For COALCAR Incidents this SOP directs the 
GECC to use WebSA to restart failing processes on COALCAR. 

■ (U//FOUO) STOCKCAR Special Instructions - For STOCKCAR Incidents this SOP directs the 
GECC to use WebSA to restart failing pr ocesses on STOCKCAR. 

■ (U//FOUO) LONGHAUL System Support - For 

LONGHAUL Incidents that require SA support for rebooting machines, etc. this URL directs 
the GECC to use the T3332 Infrastructure Operations page. 

(U) Tier 2 Support 

(U//FOUO) Tier 2 Support is provided by Maintenance/Operations Support (LONGHAUL team). 
Maintenance/Operations Support provides the day-to-day administration and support of 
production systems in accordance with documented, deployed configurations. Doing so usually 
requires specific knowledge about the associated servers, applications and how they interact. 
With respect to applications, this is referred to as "applications administration", as opposed to 
"systems administration" which is performed at the server hardware and operation systems (OS) 
level. Tier 2 also serves as the escalation point for problems not resolved at the Tier 1 level. 
Problems related to the internal workings of the software or are integration-related issues are 
escalated to the appropriate Tier 3 organization for resolution. Use the "Tier 2 Support" link 
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above for more information. 



(U//FOUO) Troubleshooting Resources 



(U) LONGHAUL_Take_Home_Support_SOP - Contains troubleshooting instructions 

LONGHAUL Tier 2 support staff can take home. 

(U) Troubleshooting Help for Tier 2 Personnel 

- Page contains links to support pages for the various 
LONGHAUL components and possible solutions to previously seen issues. 

Links - A directory 

of useful support links. Contains troubleshooting instructions LONGHAUL Tier 2 support 
staff can take home. 

Operations ~ 

Page contains the procedures to take when switching operations to alternate site 

(U) LONGHAUL After Hours Beachhead 

|) - Location of after hours supp ort 

(U) Creating a CES Help Ticket - Process 

for creating a CES help tic ket for LONGHAUL issues. 

Procedures - Process 

for reporting on Tier 2 issues. 



(U//FOUO) Outage Process 



(U) For unexpected/emergency outages: 

Send message to LH customers (see outage email list < 

I). Be sure to include how the 

system was aneccea ana an estimate oi now long it wnl take to restore the system. 

If system remains unavailable 1 hour after t roubleshooting began, switch operations t o 
the alternate site (see s witching operations 

>• 

If system continues to be unavailable after 90 minutes, inform T532 management. Be 
sure to include how the system was affected and an estimate of how long it will take to 
restore the system. 

If system continues to be unavailable after 2 hours, inform T53 management. Be sure to 
include how the system was affected and an estimate of how long it will take to restore 

the system. 

(U) For^cheduled outages, follow the nonnal outage procedure 



(U//FOUO) Contacting the GECC 

■ (U//FOUO) The GECC director 

■ (U//FOUO)^^^^^^^|- The Turbulence desk where LONGHAUL support personnel are 
located. 

■ (U//FOUO) T3332 Infrastructure Operations 
(for reboots of system after-hours) 

(U) Tier 3 Support 

(U//FOUO) Tier 3 support is provided by Development Support (LONGHAUL team). 

Development Support resolves issues escalated from Tier 2 related to the internal workings of the 
software (i.e., requires "cracking open the code") or COTS/GOTS integration. These are break/fix 
activities, which are outside of typical development, and implementation activities (such as 
resource planning, project management, architecture, s/w development, initial implementation 
/integration/testing, etc.). Tier 3 support consists of: 
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■ (U) Release Procedures - managing maintenance releases 

■ (U) Outage Procedures - Managing and Scheduling Outages using 

(U) Site Deployments 

Deployments - 

information about upcomm^it^deploymen^^TC^Se^ers^^^^^^ 

(U) Transition 

(TS//SI//REL) Transitioning Life Cycle Support of LONGHAUL is contingent upon successful 
completion of FOC in September 2011. The system will transition to the following organizations: 



■ HPC Integration and Produc tion (T53 

■ Office ) 

■ Office (OTP 



(U//FOUO) Planning for this transition began in April 2010 and is ongoing. 



(U//FOUO) For more detailed information, see Transition. 

(U//FOUO) Team Members 



Government Team Members/LONGHAUL 
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Name 0 



Contractor Team Members/LONGHAUL 

Function Affiliation Work Black 
0 0 Phone 0 



SID 0 



Sotera 



Softtech 

Solutions 



I Sotera 



I Sotera 



I Sotera 



I Sotera 



I Sotera 



I Sotera 



I Sotera 



I Sotera 



Sotera 



Sotera 



JSignout 

0 




1 in I 






( ^ ) 






| GFTD 1 






1 to | 






| GFTD | 






( in | 






1 ta 1 






[ in ) 






1 in 1 






( m ] 





[ GFTD | 



| GFTD 1 
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Developer 


Sotera 


Developer 


Sotera 


Developer 


Sotera 


Developer 


Sotera 



ln ) 



In I 



inZD 



i "!□ 



MIDRIFT Team Members 




Function 

0 


Affiliation 

0 


Branch 

Manager 


Govt 1 


Deputy 

Branch 

Manager 


Govt 1 


Lead 

Developer 


Govt 1 


Developer 


Govt 1 



Work Black 
Phone 
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Related Team Members 




Function 

0 


Affiliation 

0 


Work 

Black 

Phone 

0 


JSignout 

0 




McLendon 






1 m ) 




Program B 
T&E 


Govt 






( to 1 




Program B 
T&E 


DigiFlight 






1 m ) 





Other Useful Numbers 



Name 

0 


SID 

0 


Function 

0 


GECC 




T332 

Global 

Enterprise 

Command 

Center 



Affiliation 



24/7 

Enterprise 

Monitoringl 



Work Black 
Phone 0 



Work 
Secure 0 




(U) See also 

(S//SI//REL) The LONGHAUL team works with the following organizations: 



to develop, deploy and test all aspects of an end-to-end processing system. Team members are 
located in the OPS2A, NBP322, and NBP140. 



Digital Network Crypt Applications (S31322) 
Attack Services (S31241) 

Requirements and T hread Management (S3 13) 
CA Databases (T532 
Mission Capabilities 

High Performance Computing Technology 
/td/hpctp/) ,T5) 



■ (U//FOUO) T5/S31243 - LONGHAUL - C2DP Tour Description 

■ (U//FOUO) Cryptanalytic Computer Network Operations Development Program (C2DP) 

■ LONGHAUL Glossary 

■ (U//FOUO)LONGHAUL Frequently Asked Question 

■ (U//FOUO) Proposed LONGHAUL 2 Coverterms 



(U) External links 

■ (U) The L03 Coverterm pa ge ("go coverterm 

■ (U) The Query a Coverterm 
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